Comfy Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a benign local ComfyUI image-generation helper, with expected local-service access and limited provenance to notice.

This skill looks safe for its stated purpose if you already run a trusted local ComfyUI instance. Before installing, confirm you are comfortable with prompts being sent to http://127.0.0.1:8188 and review workflow.json, since the skill has no listed source homepage.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill may submit prompts to your local ComfyUI instance and consume local CPU/GPU resources to generate images.

Why it was flagged

The skill directs the agent to send user prompts to a local ComfyUI endpoint using the provided workflow. This is purpose-aligned, but it does interact with a local service and can trigger image-generation work.

Skill content

`generate_image(prompt: string)`: 接收使用者的描述並發送到 ComfyUI。

- endpoint: http://127.0.0.1:8188
- workflow: workflow.json

Recommendation

Use it only if you intentionally run and trust ComfyUI at 127.0.0.1:8188, and review the workflow before submitting prompts.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less external context for who maintains the skill or where it originated, although the provided artifacts are small and readable.

Why it was flagged

The skill has limited provenance information. There is no install script or executable code in the artifacts, so this is a transparency note rather than a material concern.

Skill content

Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review SKILL.md and workflow.json yourself before installing, especially because no source repository or homepage is provided.